Loading story…
Trend Micro analyzed YourCyanide, a Windows CMD-based malware strain tied to the GonnaCope/Kekware/Kekpop family that blends ransomware behavior with worm-like propagation and information theft. The malware uses multilayer batch-script obfuscation and staged payload delivery via Discord, Pastebin, and a Microsoft document link, then establishes persistence through registry Run keys and copies placed in the Startup folder. It can disable Task Manager, stop security tools, enable RDP, open firewall ports, and spread through email and removable drives.
The malware also exfiltrates tokens, browser passwords, host details, and Minecraft-related credentials through the Telegram Bot API while attempting to evade analysis by checking for usernames associated with sandboxes and researchers. Trend Micro said the ransomware routine was not fully implemented at the time of analysis; instead of robust encryption, YourCyanide renamed files in common user directories and dropped ransom notes demanding $500 in Bitcoin, indicating an evolving threat that mixes disruptive and espionage-style capabilities.
Pull IOCs and campaign context straight into your stack.
6 events from the most recent confirmed update back to the earliest known activity.
Trend Micro reported 2022-05-13 as the earliest VirusTotal upload date for YourCyanide. This is the earliest explicit date tied to the specific YourCyanide variant.
Trend Micro reported 2022-05-11 as the earliest VirusTotal upload date for Kekware. This documented another successive variant in the malware family before YourCyanide appeared.
Trend Micro reported 2022-05-07 as the earliest VirusTotal upload date for Kekpop, another variant in the same CMD-based ransomware family. The upload shows the family expanding beyond GonnaCope.
Trend Micro cited 2022-04-07 as the earliest VirusTotal upload date for GonnaCope. This provides a specific dated anchor for the family’s early circulation.
Trend Micro reported that the earliest known sample in the CMD-based ransomware family, GonnaCope, was found in April 2022 by Twitter user Petrovic. This marks the earliest referenced appearance of the malware family that later included Kekpop, Kekware, and YourCyanide.
Trend Micro published an analysis of YourCyanide as the latest variant in the GonnaCope/Kekware/Kekpop family, describing its obfuscation, propagation, persistence, and information-stealing behavior. The report stated that the ransomware was still under development and that its encryption routine was not yet fully implemented.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. View all 60 in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
Pull the IOCs, campaigns, and victimology behind this family, ready to push into your SIEM and EDR.
1 reference tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Multiple reports describe **active malware campaigns targeting Windows users** with a focus on **credential, session, and wallet theft** delivered through social engineering and abuse of legitimate services. **CharlieKirk Grabber**, a Python infostealer packaged with *PyInstaller*, is distributed via phishing, cracked software, cheats, and social-media lures; it kills browser processes (via `TASKKILL`) to access credential stores, collects passwords/cookies/autofill/Wi‑Fi data, zips the loot, uploads it to *GoFile*, and relays the download link to operators via **Discord webhooks** or **Telegram bots**. Separately, attackers are buying **Facebook ads** impersonating Microsoft to drive victims to cloned Windows 11 download pages on lookalike domains (e.g., `ms-25h2-update[.]pro`), delivering a malicious installer that steals saved passwords, browser sessions, and **cryptocurrency wallet** data; the campaign uses **geofencing/sandbox evasion** to show benign content to data-center IPs while serving malware to likely end users. Other contemporaneous activity highlights broader Windows-targeted intrusion tradecraft and adjacent threats. FortiGuard Labs reported **Winos 4.0 (ValleyRat)** phishing campaigns in Taiwan using tax and e-invoice lures, with delivery chains including malicious **LNK** downloaders, **DLL sideloading**, and **BYOVD** using the vulnerable driver `wsftprm.sys`, supported by rapidly rotating domains and cloud hosting. In LATAM, a fake bank-receipt lure delivers **XWorm v5.6** via a `.pdf.js` double-extension WSH dropper that uses junk-padding and Unicode obfuscation, then reconstructs and runs PowerShell (spawned via WMI) and abuses trusted hosting (e.g., Cloudinary) for later stages—enabling credential theft and potential ransomware follow-on. Additional reporting covered a USB-propagating **Monero cryptomining** operation capable of crossing air-gapped environments, a new Linux **SysUpdate** variant with encrypted C2 traffic (and a Unicorn Engine-based decryption approach developed during DFIR), and the **Foxveil** loader abusing **Cloudflare Pages, Netlify, and Discord** to stage shellcode and persist via services or *SysWOW64* masquerading—these are separate threats but reinforce the trend of attackers blending into trusted infrastructure and common user workflows.
Jun 29, 2026
**ICEDID** (Bokbot), a modular banking trojan active since 2017, is delivered through phishing campaigns and can provide initial access for follow-on tools including Cobalt Strike and ransomware. Recent variants use multistage loaders and bot payloads, with lures such as ZIP archives containing ISO files and malicious LNK shortcuts that invoke `rundll32.exe`; earlier campaigns also used password-protected ZIP files carrying macro-enabled Word documents. The malware persists through scheduled tasks or Windows Registry Run keys, retrieves components dynamically, and supports credential and browser-cookie theft, host discovery, command execution, browser-traffic proxying, process injection, reverse shells, and VNC access. ICEDID-enabled intrusions have progressed rapidly to RansomExx deployment: one observed operation used ICEDID, Vatet, PyXie, and Cobalt Strike to reach ransomware execution in roughly five hours. RansomExx operators also developed a Linux ELF variant targeting VMware-related storage environments, recursively encrypting a supplied directory with AES keys protected by a hardcoded RSA-4096 public key. Defenders can more reliably identify ICEDID command-and-control infrastructure through its TLS certificate-pinning implementation—validating certificate serial numbers against public-key hashes—combined with self-signed certificate metadata and scan results; JARM and JA3S fingerprints alone are not sufficient for attribution.
Sep 9, 2026
Microsoft disclosed a destructive Go-based Windows backdoor dubbed **GigaWiper** that has been observed in compromised environments since October 2025, combining espionage, remote access, and sabotage functions in a single modular implant. The malware supports about 20 command codes and can wipe physical disks, overwrite the Windows drive, trigger BSOD-based disruption, clear event logs, manipulate processes, services, and the registry, capture screenshots, record screens, and provide hidden VNC-like remote control. It also masquerades as OneDrive and uses **RabbitMQ**, **Redis**, and in some reporting **MinIO** for command, result handling, and data exfiltration. Microsoft said GigaWiper appears to be assembled from at least three malware families, with code overlaps linking it to **Crucio** and **FlockWiper** and references to a broader framework labeled **GRAT**. One destructive component mimics ransomware by encrypting files without preserving a recovery key, making restoration impossible except from clean backups, while another performs multi-pass secure wiping. Separate reporting said the same hashes and command-and-control infrastructure matched Binary Defense's earlier **BLUERABBIT** findings, and cited broader research associating related tooling with likely Iran-linked operations targeting Israeli organizations, though Microsoft did not publicly attribute the activity to a country.
Jul 17, 2026